6.5.1

Table Of Contents
c Use options to save the contents of each packet or the contents of a limited number of packets to
a .pcap or .pcapng file.
n
To save packets to a .pcap file, use the --outfile option.
n
To save packets to a .pcapng file, use the --ng and --outfile options.
You can open the file in a network analyzer tool such as Wireshark.
By default, the pktcap-uw utility saves the packet files to the root folder of the ESXi file system.
d Use the--count option to monitor only a number of packets.
4 If you have not limited the number of packets by using the --count option, press Ctrl+C to stop
capturing or tracing packets.
Example: Capture Packets That Are Received at a Virtual Machine from an IP Address
192.168.25.113
To capture the first 60 packets from a source that is assigned the IP address 192.168.25.113 when they
arrive at a virtual machine adapter with port ID 33554481 and save them to a file called
vmxnet3_rcv_srcip.pcap, run the following pktcap-uw command:
pktcap-uw --switchport 33554481 --capture Vmxnet3Rx --srcip 192.168.25.113 --outfile
vmxnet3_rcv_srcip.pcap --count 60
What to do next
If the contents of the packet are saved to a file, copy the file from the ESXi host to the system that runs a
graphical analyzer tool, such as Wireshark, and open it in the tool to examine the packet details.
Capture Packets for a VMkernel Adapter
Monitor packets that are exchanged between a VMkernel adapter and a virtual switch by using the
pktcap-uw utility.
You can capture packets at a certain capture point in the flow between a virtual switch and a VMkernel
adapter. You can also determine a capture point by traffic direction with regard to the switch and proximity
to the packet source or destination. For information about supported capture points, see Capture Points
of the pktcap-uw Utility.
Procedure
1 (Optional) Find the name of the VMkernel adapter that you want to monitor in the VMkernel adapter
list.
n
In the vSphere Web Client, expand Networking on the Configure tab for the host and select
VMkernel adapters.
n
In the ESXi Shell to the host, to view a list of the physical adapters, run the following console
command:
esxcli network ip interface list
vSphere Networking
VMware, Inc. 227